---
id: CVE-2026-92942
title: >-
  vm2 before 3.11.7 (affected versions <= 3.11.6) does not enforce the VM({
  timeout }) option on code executed outside the synchronous VM#run() call
summary: >-
  vm2 before 3.11.7 (affected versions <= 3.11.6) does not enforce the VM({
  timeout }) option on code executed outside the synchronous VM#run() call. The
  timeout only wraps the single call to _runScript() via doWithTimeout() in
  lib/vm.js, …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-400
  - CWE-1100
  - CWE-841
vendor: patriksimek
product: vm2
affected:
  - vm2 < 3.11.7
published: '2026-09-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:17:30.843'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92942'
references:
  - url: 'https://github.com/patriksimek/vm2/security/advisories/GHSA-r4fx-v8hh-22mv'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/vm2-before-3.11.7-timeout-bypass-via-finalizationregistry
    label: disclosure@vulncheck.com
  - url: 'https://github.com/patriksimek/vm2/security/advisories/GHSA-r4fx-v8hh-22mv'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92942.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-92942'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2536038'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-92942'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92942'
  - url: 'https://access.redhat.com/errata/RHSA-2026:72712'
  - url: 'https://access.redhat.com/errata/RHSA-2026:72722'
  - url: >-
      https://github.com/patriksimek/vm2/commit/fe2fcca2a1e693548993eccc624489dc4cb586b4
  - url: 'https://github.com/patriksimek/vm2/releases/tag/v3.11.7'
  - url: 'https://github.com/advisories/GHSA-r4fx-v8hh-22mv'
tags:
  - nvd
  - cve.org
  - exploit-available
  - csaf
  - vex
  - red-hat
  - ghsa
  - npm
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-18T19:34:17.365666Z'
epss: 0.00488
epssPercentile: 0.41798
ingestedAt: '2026-09-17T14:19:30.985Z'
patched:
  - ansible_automation_platform 2.1
  - ansible_automation_platform 2.2
aliases:
  - GHSA-r4fx-v8hh-22mv
ecosystem: npm
---

## Overview

vm2 before 3.11.7 (affected versions <= 3.11.6) does not enforce the VM({ timeout }) option on code executed outside the synchronous VM#run() call. The timeout only wraps the single call to _runScript() via doWithTimeout() in lib/vm.js, and FinalizationRegistry and WeakRef are exposed to sandboxed code unmodified (they are not among the hardened globals in lib/setup-sandbox.js). Sandboxed code can register a FinalizationRegistry cleanup callback against an object and then drop the only strong reference to it; vm.run() returns within the configured timeout, but when the V8 garbage collector later reclaims the object it invokes the sandboxed cleanup callback outside any vm2 timeout accounting. A busy loop in that callback blocks the host event loop for an unbounded period, resulting in denial of service. The time of invocation depends on the garbage collector (e.g. under memory pressure or with --expose-gc).

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Developer Hub, Self-service automation portal 2 · no fix planned: Red Hat Developer Hub, Self-service automation portal 2 · updated 2026-09-28 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92942.json)
- **RHSA-2026:72712** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.1 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72712)
- **RHSA-2026:72722** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72722)

## Package advisory (CVE-2026-92942)

Affected packages:

- `vm2 <= 3.11.6`

Patched in:

- `vm2 3.11.7`

Source: https://github.com/advisories/GHSA-r4fx-v8hh-22mv